I've built a ASP.NET MVC 3 (RC at the moment) site that uses OpenID login system. I was still learning about OpenID while implementing this so I commented the code heavily. The result is a site that let's users login/register with OpenID, add other OpenIDs to their account and also remove them. This little project can be then used as a starting point for any new project that would use OpenID login system. It can also be used as a resource for people to learn OpenID with.

I decided to release this project as open source. This will be my first open source project and I need to decided what license to use. I want people to be able to use this for any purpose they wish for. They can learn from it, use it for commercial or non-commercial projects and make their own forks of the code. It would also be nice for others to be able to contribute back to the project with stuff like bug fixes on sites like GitHub. But I'd like to be the copyright owner of the code that is under my control. For example the code that is in my GitHub repository (I'll call this the main code base). I've heard that for this I need to get every contributor, that adds code to this code base, to give me the copyright for their contribution. How exactly does this work?

I also use other licensed (mostly open source) resources in my projects. Here's their list and their licenses:

DotNetOpenAuth (Ms-PL)

T4MVC (part of MvcContrib which is licesned using Apache License 2.0)

ASP.NET MVC (Ms-PL)

ADO.NET Entity Framework CTP4 (I couldn't find a license)

I of course want to use the main code base for any type of projects I want. Commercial, non-commercial, open source, ...

So I have some very important questions here:

Which license should I use? I think GPL or LGPL is not suitable here. I was looking at Apache 2, New BSD, MIT and Ms-PL. Ms-PL seems to be a good fit as, but I'm not sure.

What restrictions and/or obligations do I have towards the resources I use in this project? I think I read somewhere that I have to add -LICENSE.txt for Ms-PL resources. Is that true? How does this work for Apache 2 and other licenses? What do I have to do if I modify any of these resources' code and then use that in my project?

I'd also really like a "as-is" clause in the license, so people can't sue me if something goes wrong while they're using my code.

Do I need to add anything to my files to make clear what the license is? If so, how do I format that?

Also one last thing. If I decide to make a Visual Studio template out of this samples how do I license that?

2 Answers
2

Since you're using MS-PL and Apache 2.0 components, you're restricted by the MS-PL license and the Apache 2.0 license. This means you can't use the GPL anyway, since it's incompatible with MS-PL, and version 2 of the GPL is also incompatible with Apache 2.0. Given that, I would suggest releasing your parts either under MS-PL, Apache 2.0, or a BSD-style, so you're not adding requirements.

You can read the licenses to see what you have to do. They aren't long. With MS-PL, you can do pretty much everything as long as everything's released under MS-PL and you include the entire license (which isn't long). With Apache 2.0, it's pretty much the same, except that you need to include any NOTICE file. You do have to include all attributions, etc., and that's pretty standard across OS licenses.

You really can't add to the licenses. You are free to put any disclaimers you want. You can put them in a NOTICE file, which under Apache 2.0 requires them to be preserved.

You should list which files are under which licenses, and you do have to include full copies of MS-PL and Apache 2.0 in the package.

Be careful about ADO.NET Entity Framework CTP4, as you say you can't find a license. If you can't find a license, ordinary copyright law applies, and you can't legally use it. You may want to write to whoever owns that code, and see what license they use.

As far as copyright ownership goes, you can never retract open source licenses for the versions you release under them, but if you own all applicable copyrights you can relicense as you wish. Some companies, like MySQL AB, released what they had under the GPL, and would sell other licenses for money, so that (say) another company could use MySQL as a part of their commercially sold product without having to release under the GPL.

Since you're using components owned by other people, you really can't do that with the entire project, but you could with your portions.

To do that, you'd have to get everybody who contributes to fill out a copyright assignment form, along with some proof that they do own the copyright (and, for example, that it doesn't count as work for hire for an employer). This does tend to diminish user contributions, so you may want to skip it entirely. You might want to look at what the Gnu project does, since they do want complete copyright, and emulate them.

Thanks for this extensive answer. I did some search and found that Ms-PL is NOT GPL compatible (see bit.ly/aACG5U). And as far as I've read it is also not viral (see stackoverflow.com/questions/175762/…;. It would probably be very unproductive of Microsoft to release ASP.NET MVC under Ms-PL and then make everyone release software using it under Ms-PL. For example all all Stack Exchange communities (starting with SO) are using ASP.NET MVC and DotNetOpenAuth. And I've also seen derivatives (MvcTrubine) release under different licenses.
–
gligoranNov 19 '10 at 16:38

1

@Gligoran: Thanks for the link and for correcting one of my mistakes. I'll edit the answer appropriately.
–
David ThornleyNov 19 '10 at 17:45

Thank you, David. I'm looking forward to your edit as you seem to understand a lot more about this whole thing as I do.
–
gligoranNov 19 '10 at 17:47

I saw your edit and as I thought Apache v2 and Ms-PL are quite similar. I've heard that Apache v2 is a bit more defined so I'm probably going to go with that I'm just waiting for some answers from people who have projects on CodePlex and chose either on of those. Thanks for your help. And I'll post what I decide.
–
gligoranNov 19 '10 at 20:44

The problem here is that I do not wish to release this as a web application. It technically is one as it can be run on a server and it would work if the server is configured properly, but it would not do you much good. This is meant to be starting point FOR web applications. These web applications derived from it can then be open source, commercial or non-commercial or any other kind (if there is any). That said I've never actually read AGPL or even heard much about it. But I've heard about GPL and AGPL. How do they compare?
–
gligoranNov 19 '10 at 16:19

2

@gligoran: The AGPL is a version of the GPL that requires sharing of code if you make its running available over the web. Before networks like the web, executing software was normally done on the user's computer, and the GPL covers that nicely. With the web, you can have users run software on your servers conveniently, and then you aren't distributing or conveying software in the GPL sense. The AGPL was meant to close that loophole (if you consider it a loophole) by requiring sharing of such server software. It's never been tested, and I doubt it will hold up in court.
–
David ThornleyNov 19 '10 at 16:24